LPI LPI Linux Networking Administration. Practice Test. Updated: Dec 26, 2009 Version 2.1

Transcription

1 LPI LPI Linux Networking Administration Practice Test Updated: Dec 26, 2009 Version 2.1

2 QUESTION NO: 1 CORRECT TEXT According to the dhcpd.conf file below, which domain name will clients in the /24 network get? Answer: lab.certkiller.com QUESTION NO: 2 Which of the following sentences is true about ISC DHCP? A. It can't be configured to assign addresses to BOOTP clients. B. Its default behavior is to send DHCPNAK to clients that request inappropriate addresses. C. It can't be used to assign addresses to X - terminals. D. It can be configured to only assign addresses to known clients. E. None of the above. Answer: D QUESTION NO: 3 The host, called " Certkiller ", with the MAC address "08:00:2b:4c:59:23", should always be given the IP address of by the DHCP server. Which of the following configurations will achieve this? A. hostcertkiller { hardware-ethernet 08:00:2b:4c:59:23; fixed-address ; } "Pass Any Exam. Any Time." - 2

3 B. hostcertkiller { mac=08:00:2b:4c:59:23; ip= ; } C. hostcertkiller = 08:00:2b:4c:59: D. hostcertkiller { hardware ethernet 08:00:2b:4c:59:23; fixed-address ; } E. hostcertkiller { hardware-address 08:00:2b.4c:59:23; fixed-ip ; } Answer: D QUESTION NO: 4 Which dhcpd.conf option defines the DNS server address(es) to be sent to the DHCP clients? A. domainname B. domain-name-servers C. domain-nameserver D. domain-name-server QUESTION NO: 5 What is a significant difference between host and zone keys generated by dnssec-keygen? A. There is no difference. B. Both zone key files(.key/.private ) contain a public and private key. C. Both host keys files(.key/. private) contain a public and private key. D. Host Keys must always be generated if DNSSEC is used; zone keys are optional E. Zone Keys must always be generated if is used; host keys are optional QUESTION NO: 6 CORRECT TEXT "Pass Any Exam. Any Time." - 3

4 According to the configuration below, what is the address of the administrator for this domain? LPI : Practice Exam Answer: QUESTION NO: 7 Which of these would be the simplest way to configure BIND to return a different version number to queries? A. Compile BIND with the option -blur-version=my version. B. Set version-string "my version" in BIND's configurationfile. C. Set version "my version" in BIND's configurationfile. D. Set version=my version in BIND's configuration file. E. Ser version-bind "my version" in BIND's configuration file. Answer: C QUESTION NO: 8 A. Any host, from any network, may use this server as its main DNS server. B. If the server doesn't know the answer to a query, it sends a recursive query to "Pass Any Exam. Any Time." - 4

5 C. If the server doesn't know the answer to a query, it sends a query to a root DNS server. D. Hosts in the network /24 will be able to ask for zone transfers. E. If the server doesn't know the answer to a query, it sends a recursive query to and, if this fails, it returns a failure. QUESTION NO: 9 A BIND server should be upgraded to use TSIG. Which configuration parameters should be added, if the server should use the algorithm hmac-md5 and the key skrkc4dotzi/takllpi7jza==? A. TSIG server.example.com. algorithmhmac-md5; secret"skrkc4dotzi/takllpi7jza=="; }; B. key server.example.com. { algorithmhmac-md5; secretskrkc4dotzi/takllpi7jza==; }; C. key server.example.com. { algorithmhmac-md5; secret"skrkc4dotzi/takllpi7jza=="; }; D. key server.example.com. { algorithm=hmac-md5; secret="skrkc4dotzi/takllpi7jza=="; }; E. key server.example.com. { algorithmhmac-md5 secret"skrkc4dotzi/taki1pi7jza==" }; Answer: C QUESTION NO: 10 DNSSEC is used for? A. Encrypted DNS queries betweennameservers. B. Cryptographic authentication of DNS zones. "Pass Any Exam. Any Time." - 5

6 C. Secondary DNS queries for local zones. D. Defining a secure DNS section. E. Querying a secure DNS section. QUESTION NO: 11 CORRECT TEXT Using only commands included with named, what is the command, with options or parameters, to make named re-read its zone files? Answer: rndc reload QUESTION NO: 12 CORRECT TEXT Which type of DNS record defines which server(s) for a domain should be sent to? Answer: MX QUESTION NO: 13 Some users are unable to connect to specific local hosts by name, while accessing hosts in other zones works as expected. Given that the hosts are reachable by their IP addresses, which is the default log file that could provide hints about the problem? A. /var/named/log B. /var/lib/named/dev/log C. /var/log/bind_errors D. /var/log/bind/errors E. /var/log/messages Answer: E QUESTION NO: 14 A BIND server should never answer queries from certain networks or hosts. Which configuration directive could be used for this purpose? A. deny-query{...; }; B. no-answer{...; }; "Pass Any Exam. Any Time." - 6

7 C. deny-answer{...; }; D. deny-access{...; }; E. blackhole {...; }; LPI : Practice Exam Answer: E QUESTION NO: 15 What is the purpose of a PTR record? A. To provide name to IP resolution. B. To provide IP to name resolution. C. To direct to a specific host. D. To provide additional host information. E. To direct clients to anothernameserver. QUESTION NO: 16 Performing a DNS lookup with dig results in this answer: What might be wrong in the zone definition? A. Nothing. All seems to be good. B. There's no "." after linuserv.example.net in the PTR record in the forward lookup zone file. C. There's no "." afterlinuserv in the PTR record in the forward lookup zone file. D. There's no "." after linuserv.example.net in the PTR record in the reverse lookup zone file. E. The "." in the NS definition in reverse lookup zone has to be removed. Answer: D QUESTION NO: 17 What directive can be used in named.conf to restrict zone transfers to the /24 network? "Pass Any Exam. Any Time." - 7

8 A. allow-transfer{ /24; }; B. allow-transfer{ /24 }; C. allow-axfr { /24; }; D. allow-axfr { /24 }; E. allow-xfer { /24; }; Answer: A QUESTION NO: 18 To securely use dynamic DNS updates, the use of TSIG is recommended. Which TWO statements about TSIG are true? A. TSIG is used for zone data encryption B. TSIG is a signal to start a zone update C. TSIG is used in zone files D. TSIG is used only in server configuration E. Servers using TSIG must be in sync (time zone!) Answer: D,E QUESTION NO: 19 CORRECT TEXT In which configuration file can a key-file be defined to enable secure DNS zone transfers? (Please enter the file name without the path) Answer: named.conf QUESTION NO: 20 CORRECT TEXT The users of the local network complain that name resolution is not fast enough. Enter the command, without the path or any options, that shows the time taken to resolve a DNS query. Answer: dig QUESTION NO: 21 Which option is used to configure pppd to use up to two DNS server addresses provided by the remote server? "Pass Any Exam. Any Time." - 8

9 A. ms-dns B. nameserver C. usepeerdns D. dns E. None of the above LPI : Practice Exam Answer: E QUESTION NO: 22 A DNS server has the IP address Which TWO of the following need to be done on a client machine to use this DNS server? A. Addnameserver to /etc/resolv.conf B. Run route addnameserver C. Runifconfig eth0 nameserver D. Run echo "nameserver " >> /etc/resolv.conf E. Runbind nameserver Answer: A,D QUESTION NO: 23 The mailserver is currently called fred, while the primary MX record points to mailhost.example.org. What must be done to direct example.org towards fred? A. Add an A record formailhost to fred's IP address. B. Add a CNAME record frommailhost to fred C. Add another MX record pointing tofred's IP address. D. Add a PTR record frommailhost to fred. Answer: A QUESTION NO: 24 CORRECT TEXT Which port must be open on a firewall, to allow a DNS server to receive queries? (Enter only the port number). Answer: 53 "Pass Any Exam. Any Time." - 9

10 QUESTION NO: 25 LPI : Practice Exam Which of these ways can be used to only allow access to a DNS server from specified networks/hosts? A. Using thelimit{...;};statement in the named configuration file. B. Using the allow-query{...;};statement in the named configuration file. C. Using the answeronly{...;};statement in the named configuration file. D. Using theanswer{...;};statement in the named configuration file. E. Using the queryaccess{...;};statement in the named configuration file. QUESTION NO: 26 CORRECT TEXT Which is the preferred mail server for the domain example.com, according to the BIND configuration below? (Type the fully-qualified domain name.) Answer: mx-ny.certkiller.com QUESTION NO: 27 There is a restricted area in an Apache site, which requires users to authenticate against the file /srv/www/security/site-passwd. Which command is used to CHANGE the password of existing users, without losing data, when Basic authentication is being used. A. htpasswd -c /srv/www/security/site passwd user B. htpasswd /srv/www/security/site-passwd user C. htpasswd -n /srv/www/security/site-passwd user D. htpasswd -D /srv/www/security/site-passwd user E. None of the above. "Pass Any Exam. Any Time."

11 QUESTION NO: 28 LPI : Practice Exam Consider the following / srv/www/ default/html/ restricted/.htaccess AuthType Basic AuthUserFile / srv/www/ security/ site-passwd AuthName Restricted Require valid-user Order deny,allow Deny from all Allow from /24 Satisfy any Considering that DocumentRoot is set to /srv/www/default/html, which TWO of the following sentences are true? A. Apache will only grant access to authenticated users connecting from clients in the /24 network B. This setup will only work if the directory /srv/www/default/html/restricted/ is configured with AllowOverride AuthConfig Limit C. Apache will require authentication for every client requesting connections to D. Users connecting from clients in the /24 network won't need to authenticate themselves to access E. The Satisfy directive could be removed without changing Apache behaviour for this directory,d QUESTION NO: 29 A web server is expected to handle approximately 200 simultaneous requests during normal use with an occasional spike in activity and is performing slowly. Which directives in httpd.conf need to be adjusted? A. MinSpareServers & MaxSpareServers. B. MinSpareServers, MaxSpareServers, StartServers & MaxClients. C. MinServers, MaxServers & MaxClients. D. MinSpareServers, MaxSpareServers, StartServers, MaxClients & KeepAlive. QUESTION NO: 30 "Pass Any Exam. Any Time."

12 Which statements about the Alias and Redirect directives in Apache's configuration file are true? A. Alias can only reference files underdocumentroot B. Redirect works with regular expressions C. Redirect is handled on the client side D. Alias is handled on the server side E. Alias is not a valid configuration directive Answer: C,D QUESTION NO: 31 CORRECT TEXT Which file, in the local file-system, is presented when the client requests and the following directive is present in server's Apache configuration file? UserDir site/html Given that all users have their home directory in /home, please type in the FULL file name including the path. Answer: /home/joe/site/html/index.html QUESTION NO: 32 When Apache is configured to use name-based virtual hosts: A. it's also necessary to configure a different IP address for each virtual host. B. the Listen directive is ignored by the server. C. it starts multiple daemons (one for each virtual host). D. it's also necessary to create avirtualhost block for the main host. E. only the directivesservername and DocumentRoot may be used inside a block. Answer: D QUESTION NO: 33 CORRECT TEXT Enter one of the Apache configuration file directives that defines where log files are stored. Answer: ErrorLog QUESTION NO: 34 "Pass Any Exam. Any Time."

13 Which Apache directive is used to configure the main directory for the site, out of which it will serve documents? A. ServerRoot B. UserDir C. DirectoryIndex D. Location E. DocumentRoot Answer: E QUESTION NO: 35 Which Apache directive allows the use of external configuration files defined by the directive AaccessFileName? A. AllowExternalConfig B. AllowAccessFile C. AllowConfig D. IncludeAccessFile E. AllowOverride Answer: E QUESTION NO: 36 Which of the following is recommended to reduce Squid's consumption of disk resources? A. Disable the use of access lists. B. Reduce the size ofcache_dir in the configuration file. C. Rotate log files regularly. D. Disable logging of fully qualified domain names. E. Reduce the number of child processes to be started in the configuration file. QUESTION NO: 37 Which ACL type in Squid's configuration file is used for authentication purposes? "Pass Any Exam. Any Time."

14 A. proxyauth B. proxy_auth C. proxy_passwd D. auth E. auth_required LPI : Practice Exam QUESTION NO: 38 The listing below is an excerpt from a Squid configuration file: A. Users connecting fromlocalhost will be able to access web sites through this proxy. B. It's necessary to includea http_access rule denying access to all, at the end of the rules. C. It's possible to use this proxy to access SSL enabled web sites listening on any port. D. This proxy can't be used to access FTP servers listening on the default port. E. This proxy ismisconfigured and no user will be able to access web sites through it. Answer: D QUESTION NO: 39 In the file /var/squid/url_blacklist is a list of URLs that users should not be allowed to access. What is the correct entry in Squid's configuration file to create an acl named blacklist based on this file? A. acl blacklist urlpath_regex /var/squid/url_blacklist B. acl blacklist file /var/squid/url_blacklist C. acl blacklist "/var/squid/url_blacklist" "Pass Any Exam. Any Time."

15 D. acl blacklist urlpath_regex "/var/squid/url_blacklist" E. acl urlpath_regex blacklist /var/squid/url_blacklist Answer: D QUESTION NO: 40 Users in the acl named 'sales_net' must only be allowed to access to the Internet at times specified in the time_acl named 'sales_time'. Which is the correct http_access directive, to configure this? A. http_access deny sales_time sales_net B. http_access allow sales_net sales_time C. http_access allow sales_net and sales_time D. allowhttp_access sales_net sales_time E. http_access sales_net sales_time QUESTION NO: 41 What of the following is NOT a valid ACL type, when configuring squid? A. src B. source C. dstdomain D. url_regex E. time QUESTION NO: 42 Which Squid configuration directive defines the authentication method to use? A. auth_param B. auth_method C. auth_program D. auth_mechanism E. proxy_auth "Pass Any Exam. Any Time."

16 Answer: A LPI : Practice Exam QUESTION NO: 43 The Internet gateway connects the clients with the Internet by using a Squid proxy. Only the clients from the network /24 should be able to use the proxy. Which of the following configuration sections is correct? A. acl local src /24 http_allow local B. acl local src /24 http_access allow local C. acl local src /24 httpaccess allow local D. acl local src /24 http_access_allow=local E. acl local src /24 httpd local allow QUESTION NO: 44 CORRECT TEXT A malicious user has sent a 35MB video clip, as an attachment, to hundreds of recipients. Looking in the outbound queue reveals that this is the only mail there. This mail can be removed with the command rm *. Complete the path below. Answer: /var/spool/mqueue/ QUESTION NO: 45 The syntax of the procmail configuration file is? A. :0[flags][:[lockfile]] [* condition] action B. [* condition] action :0[flags][:[lockfile]] C. :0[flags][:[lockfile]] [* condition] action "Pass Any Exam. Any Time."

17 D. :0[flags][:[lockfile]]:[* condition] action E. :0[flags][:[lockfile]]:[* condition]:action Answer: A QUESTION NO: 46 Which of the following recipes will append s from "root" to the "rootmails" mailbox? A. :0c: rootmails * ^From.*root B. :0c: * ^From.*root rootmails C. :0c: * ^From=root rootmails D. :0c: * ^From=*root rootmails E. :0c: $From=$root rootmails QUESTION NO: 47 The internal network ( ) needs to be able to relay through the site's sendmail server. What line must be added to /etc/mail/access to allow this? A /24 RELAY B RELAY C /24 OK D OK "Pass Any Exam. Any Time."

18 QUESTION NO: 48 CORRECT TEXT Please enter the name of the main majordomo configuration file without the path. Answer: majordomo.cf QUESTION NO: 49 CORRECT TEXT A procmail recipe is required to delete all s marked as spam. Please complete the recipe. :0: * X-Spam-Status: Yes Answer: /dev/null QUESTION NO: 50 The following is an excerpt from a procmail configuration file: :0 c *! ^To: backup! backup Which of the following is correct? A. All mails will be backed up to the path defined by $MAILDIR. B. All mails to the local address backup will be stored in the directory backup. C. A copy of all mails will be stored in file backup. D. A copy of all mails will be send to the local address backup. E. Mails not addressed to backup are passed through a filter program named backup. Answer: D QUESTION NO: 51 Where is the user foo's procmail configuration stored, if home directories are stored in /home? Please enter the complete path to the file. Answer: /home/foo/.procmailrc "Pass Any Exam. Any Time."

19 QUESTION NO: 52 LPI : Practice Exam Which network service or protocol is used by sendmail for RBLs (Realtime Blackhole Lists)? A. RBLP B. SMTP C. FTP D. HTTP E. DNS Answer: E QUESTION NO: 53 On a newly-installed mail server with the IP address , ONLY local networks should be able to send . How can the configuration be tested, using telnet, from outside the local network? A. telnet MAIL FROM<admin@example.com> RECEIPT TO:<someone@example.org> B. telnet RCPT FROM:admin@example.com MAIL TO:<someone@example.org> C. telnet HELLO bogus.example.com MAIL FROM:<anyone@example.org> RCPT TO:<someone@example.net> D. telnet HELO bogus.example.com MAIL FROM:<anyone@example.org> RCPT TO:<someone@example.net> E. telnet HELO: bogus.example.com RCPT FROM:<anyone@example.org> MAIL TO:<someone@example.net> Answer: D QUESTION NO: 54 CORRECT TEXT "Pass Any Exam. Any Time."

20 All machines outside the network are able to send s through the server to addresses not served by that server. If the server accepts and delivers the , then it is a(n). Answer: open relay QUESTION NO: 55 Which entry in the.procmailrc file will send a copy of an to another mail address? A. :0 c B. :0 copy C. :c D. :copy E. :s Answer: A QUESTION NO: 56 Which file can be used to make sure that procmail is used to filter a user's incoming ? A. ${HOME}/.procmail B. ${HOME}/.forward C. ${HOME}/.bashrc D. /etc/procmailrc E. /etc/aliases QUESTION NO: 57 CORRECT TEXT Which file, on a majordomo server, will contain a list of all members' addresses for the mailing list "linux-users"? (Enter only the file name). Answer: linux-users QUESTION NO: 58 A user is on holiday for two weeks. Anyone sending an to that account should receive an auto-response. Which of the following procmail rules should be used, so that all incoming s "Pass Any Exam. Any Time."

21 are processed by vacation? LPI : Practice Exam A. :0c: /usr/bin/vacation nobody B. :w /usr/bin/vacation nobody C. :0fc: /usr/bin/vacation nobody D. /usr/bin/vacation nobody E. :> /usr/bin/vacation nobody Answer: A QUESTION NO: 59 What security precautions must be taken when creating a directory into which files can be uploaded anonymously using FTP? A. The directory must not have the execute permission set. B. The directory must not have the read permission set. C. The directory must not have the read or execute permission set. D. The directory must not have the write permission set. E. The directory must not contain other directories. QUESTION NO: 60 What is the correct format for an ftpusers file entry? A. Use only one username on each line. B. Add a colon after each username. C. Add a semicolon after each username. D. Add ALLOW after each username. E. Add DENY after each username. Answer: A QUESTION NO: 61 A security-conscious administrator would change which TWO of the following lines found in an SSH configuration file? "Pass Any Exam. Any Time."

22 A. Protocol 2,1 B. PermitEmptyPasswords no C. Port 22 D. PermitRootLogin yes E. IgnoreRhosts yes LPI : Practice Exam Answer: A,D QUESTION NO: 62 A system monitoring service checks the availability of a database server on port 5432 of destination.example.com. The problem with this is that the password will be sent in clear text. When using an SSH tunnel to solve the problem, which command should be used? A. ssh : :5432 destination.example. com B. ssh -L 5432:destination.example.com: C. ssh -L 5432: :5432 destination.example.com D. ssh -x destination.example.com:5432 E. ssh -R 5432: :5432 destination.example.com Answer: C QUESTION NO: 63 What must be done on a host to allow a user to log in to that host using an SSH key? A. Add their private key to ~/.ssh/authorized_keys B. Reference their public key in ~/.ssh/config C. Runssh-agent on that host D. Add their public key to ~/.ssh/authorized_keys E. Reference their private key in ~/.ssh/config Answer: D QUESTION NO: 64 CORRECT TEXT What command must be used to create an SSH key-pair? Please enter the command without the path or any options or parameters. Answer: ssh-keygen "Pass Any Exam. Any Time."

23 QUESTION NO: 65 CORRECT TEXT To allow X connections to be forwarded from or through an SSH server, what line must exist in the sshd configuration file? Answer: X11Forwarding yes QUESTION NO: 66 An SSH port-forwarded connection to the web server was invoked using the command ssh -TL 80 : user@ Which TWO of the following are correct? A. The client can connect to the web server by typing into the browser's address bar and the connection will be encrypted B. The client can connect to by typing into the browser's address barandthe connection will be encrypted C. The client can't connect to the web server by typing into the browser'saddressbar. This is only possible using D. It is only possible to port-forward connections to insecure services that provide an interactive shell (liketelnet) E. The client can connect to the web server by typing into the browser's addressbarand the connection will not be encrypted,e QUESTION NO: 67 CORRECT TEXT Which keys are stored in the authorized_keys file? Answer: public QUESTION NO: 68 Which of the following defines the maximum allowed article size in the configuration file for INN? A. limitartsize B. artsizelimit C. maxartlimit D. maxartsize E. setartlimit "Pass Any Exam. Any Time."

24 Answer: D LPI : Practice Exam QUESTION NO: 69 CORRECT TEXT In which file, on an INN news server, can access to the news server be configured? (Enter only the file name). Answer: readers.conf QUESTION NO: 70 The innd configuration file has been changed and it should be used as soon as possible. What is the fastest way to accomplish that? A. ctlinnd kill hup B. kill - HUP process id C. ctlinnd xexec innd D. ctlinnd reload innd E. /usr/sbin/innd reload Answer: C QUESTION NO: 71 What command can be used to add a new newsgroup called Certkiller that allows posting? A. ctlinnd newgroup Certkiller n news B. ctlinnd newgroup Certkiller y news C. ctlinnd addgroup Certkiller y news D. ctlinnd newgroup Certkiller +rw news E. ctlinnd addgroup Certkiller +rw news QUESTION NO: 72 Which TWO of the following commands could be used to add a second IP address to eth0? A. ifconfig eth0 - add ip B. ifconfig eth0: "Pass Any Exam. Any Time."

25 C. ifconfig eth D. ifconfig eth E. ifconfig eth0:sub ,E QUESTION NO: 73 If the command arp -f is run, which file will be read by default? A. /etc/hosts B. /etc/ethers C. /etc/arp.conf D. /etc/networks E. /var/cache/arp QUESTION NO: 74 What command must be used to print the kernel's routing table? A. route print B. route enumerate C. route show D. route list E. route Answer: E QUESTION NO: 75 What command would be used to configure the interface eth1:1 with the IP address and the netmask ? A. ifconfig eth1: netmask start B. ifconfig netmask eth1:1 up C. ifconfig eth1: netmask up D. ifconfig / eth1:1 up E. ifconfig eth1: / up "Pass Any Exam. Any Time."

26 Answer: C LPI : Practice Exam QUESTION NO: 76 Which option must be used with ifconfig, to also see interfaces that are down? A. -d B. -a C. --all D. --down E. None. QUESTION NO: 77 CORRECT TEXT What file should be edited to make the route command show human-readable names for networks? (Please enter the full path) Answer: /etc/networks QUESTION NO: 78 What is the command to add another IP address to an interface that already has (at least) one IP address? A. ifconfig eth0: B. ifconfig eth C. ipconfig eth0: D. ipconfig eth Answer: A QUESTION NO: 79 The command route shows the following output: "Pass Any Exam. Any Time."

27 Which of the following statements is correct? A. The network is not a valid route. B. The host is temporarily down. C. The host route is rejected by the kernel. D. The "!H " signals that traffic to the host is dropped. E. The network path to the host is not available. Answer: C QUESTION NO: 80 A network client has an ethernet interface configured with an IP address in the subnet /24. This subnet has a router, with the IP address , that connects this subnet to the Internet. What needs to be done on the client to enable it to use the router as its default gateway? A. Run route add defaultgw eth1. B. Run route addgw eth1. C. Runifconfig eth0 defaultroute D. Add "defaultroute " to /etc/resolv.conf. E. Run route adddefaultgw= if=eth0. Answer: A QUESTION NO: 81 A server with 2 network interfaces, eth0 and eth1, should act as a router. eth0 has the IP address in the subnet /24 and eth1 has the IP address in the subnet /16. The routing table looks fine, but no data is traversing the networks. Which TWO of the following need to be done? A. Enable IP forwarding with echo "1" > /proc/sys/net/ipv4/ip_forward B. Add new firewall chains to handle inbound & outbound traffic on both interfaces. C. Reconfigure the firewall rules to allow traffic to traverse the networks. D. The routing table needs to be restarted, for the changes to take effect. "Pass Any Exam. Any Time."

28 E. The server needs to be restarted, for the changes to take effect. Answer: A,C LPI : Practice Exam QUESTION NO: 82 What command is used to add a route to the /24 network via ? A. route add - network netmask gw B. route add - net /24gw C. route add - network / D. route add - net netmask E. route add - net netmask gw Answer: E QUESTION NO: 83 Considering the following kernel IP routing table now, which of the following commands must be emove the route to the network /24? Kernel IP routing table A. routedel B. routedel /24 C. routedel -net /24 D. routedel /24 gw E. routedel -net Answer: C QUESTION NO: 84 Which of the following sentences is true, when using the following /etc/pam.d/login file? #%PAM-l.0 "Pass Any Exam. Any Time."

29 auth required /lib/security/pam_securetty.so auth required /lib/security/pam_nologin.so auth sufficient /lib/security/pam_unix.so shadow nullok md5 use_authtok auth required /lib/security/pam_ldap.so use_first_pass account sufficient /lib/security/pam_unix.so account required /lib/security/pam_ldap.so password required /lib/security/pam_cracklib.so password sufficient /lib/security/pam_unix.so nullok use_authtok md5 shadow password required /lib/security/pam_ldap.so use_first_pass session optional /lib/security/pam_console.so session sufficient /lib/security/pam_unix.so session required /lib/security/pam_ldap.so A. All users will be authenticated against the LDAP directory B. This is the only file needed to configure LDAP authentication on Linux C. Only local users will be able to log in, when the file/etc/nologin exists D. Ordinary users will be able to change their password to be blank E. If the control flags for auth were changed to required, local users wouldn't be able to log in Answer: D QUESTION NO: 85 LDAP-based authentication against a newly-installed LDAP server does not work as expected. The file /etc/pam.d/login includes the following configuration parameters. Which of them is NOT correct? A. password required /lib/security/pam_ldap.so B. auth sufficient /lib/security/pam_ldap.souse_first_pass C. account sufficient /lib/security/pam_ldap.so D. password required /lib/security/pam_pwdb.so E. auth required /lib/security/pam_ldap.so Answer: E QUESTION NO: 86 What is the advantage of using SASL authentication with OpenLDAP? A. It can prevent the transmission of plain text passwords over the network. B. It disables anonymous access to the LDAP server. "Pass Any Exam. Any Time."

30 C. It enables the use of Access Control Lists. D. It allows the use of LDAP to authenticate system users over the network. E. All of the above. Answer: A QUESTION NO: 87 In a PAM configuration file, which of the following is true about the required control flag? A. If the module returns success, no more modules of the same type will be invoked B. The success of the module is needed for the module-type facility to succeed. If it returns a failure, control is returned to the calling application C. The success of the module is needed for the module-type facility to succeedhowever, all remaining modules of the same type will be invoked. D. The module is not critical and whether it returns success or failure is not important. E. If the module returns failure, no more modules of the same type will be invoked Answer: C QUESTION NO: 88 CORRECT TEXT In which directory are the PAM modules stored? Answer: /lib/security QUESTION NO: 89 Considering the following kernel IP routing table below, which of the following commands must be used to remove the route to the network /24? A. routedel B. routedel /24 C. routedel - net /24 "Pass Any Exam. Any Time."

31 D. routedel /24 gw E. routedel -net Answer: C QUESTION NO: 90 Which of the following is true, when a server uses PAM authentication and both /etc/pam.conf & /etc/pam.d/ exist? A. It causes error messages. B. /etc /pam.conf will be ignored. C. /etc /pam.d/ will be ignored. D. Both are used, but /etc/pam.d/ has a higher priority. E. Both are used, but /etc/pam.conf has a higher priority. QUESTION NO: 91 Which of the following tools, on its own, can provide dial-in access to a server? A. mingetty B. pppd C. dip D. chat E. mgetty Answer: E QUESTION NO: 92 When configuring a PPP dial-in server, which option is used (in the pppd configuration file) to enable user authentication against the system password database? A. login B. auth C. local D. password E. user "Pass Any Exam. Any Time."

32 Answer: A LPI : Practice Exam QUESTION NO: 93 To configure an LDAP service in the company " Certkiller Ltd", which of the following entries should be added to slapd.conf, in the Database Directives section, to set the rootdn so that the common name is Manager and the company's domain is Certkiller.com? A. rootdn cn=manager dc= Certkiller dc=com B. rootdn "cn=manager,dc= Certkiller,dc=com" C. rootdn cn= Certkiller,dc=com,dc=Manager D. rootdn "cn= Certkiller,dc=com,dc=Manager" E. rootdn "cn=manager dc= Certkiller dc=com" QUESTION NO: 94 CORRECT TEXT Which command can be used to change the password for an LDAP entry? Answer: ldappasswd QUESTION NO: 95 Which of the following commands can gather entries from the specified administrative NIS database group? A. ypserv group B. getent group C. rpcinfo group D. ypbind group E. yppoll group QUESTION NO: 96 What could be a reason for invoking vsftpd from (x) inetd? A. It's not a good idea, because (x)inetd is not secure B. Runningvsftpd in standalone mode is only possible as root, which could be a security risk C. vsftpd cannot be started in standalone mode "Pass Any Exam. Any Time."

33 D. (x)inetd has more access control capabilities E. (x)inetd is needed to run vsftpd in a chroot jail Answer: D QUESTION NO: 97 An SSH server is configured to use tcp_wrappers and only hosts from the class C network should be allowed to access it. Which of the following lines would achieve this, when entered in/etc/hosts.allow? A. ALLOW: / : sshd B. sshd : / : ALLOW C / : ALLOW: sshd D. tcpd: sshd : / : ALLOW E. sshd : ALLOW: / QUESTION NO: 98 Which TWO of the following statements about xinetd and inetd are correct? A. xinetd supports access control by time. B. xinetd only supports TCP connections. C. xinetd is faster than xinetd and should be preferred for this reason. D. xinetd includes support for X connections. E. xinetd and inetd are used to reduce the number of listening daemons. Answer: A,E QUESTION NO: 99 A correctly-formatted entry has been added to /etc/hosts.allow to allow certain clients to connect to a service, but this is having no effect. What would be the cause of this? A. tcpd needs to be sent the HUP signal. B. The service needs to be restarted. C. The machine needs to be restarted. D. There is a conflicting entry in /etc/hosts.deny. E. The service does not supporttcpwrappers "Pass Any Exam. Any Time."

34 Answer: E LPI : Practice Exam QUESTION NO: 100 Which TWO /etc/hosts.allow entries will allow access to sshd from the class C network ? A. sshd : B. sshd : C. sshd : netmask D. sshd : / E. sshd : Answer: A,D QUESTION NO: 101 Which TWO of the following statements about the tcp_wrappers configuration files are correct? A. Both files must be edited, to gettcp_wrappers to work properly B. It is possible to configuretcp_wrappers using just one file C. (x)inetd requires these files D. All programs that provide network services use these files to control access E. tcpd uses these files to control access to network services,e QUESTION NO: 102 What is the appropriate configuration file entry to allow SSH to run from inetd? A. ssh stream tcp nowait root /usr/sbin/tcpd sshd B. ssh stream tcp nowait root /usr/sbin/tcpd tcpd C. ssh stream tcpd nowait root /usr/sbin/tcpd sshd D. ssh data tcpd nowait root /usr/sbin/tcpd sshd E. ssh data tcp nowait root /usr/sbin/tcpd sshd Answer: A QUESTION NO: 103 "Pass Any Exam. Any Time."

35 Which of the following sentences is TRUE about FreeS/WAN? A. FreeS/WAN doesn't support remote users (i.e. notebook users with dynamic IP addresses) connecting to the LAN B. FreeS/WAN needs a patch to support NAT traversal for users behind a NAT gateway C. FreeS/WAN doesn't require any Linux kernel 2.4 modules to work properly D. FreeS/WAN only enables the use of strong encryption between Linux hosts E. FreeS/WAN can't be used to establish a VPN between a Linux host and a Microsoft Windows 2000 Server host QUESTION NO: 104 As of Linux kernel 2.4, which software is used to configure a VPN? A. IPSec B. SSH C. net - tools D. FreeS/WAN E. iproute2 Answer: D QUESTION NO: 105 A program, called vsftpd, running in a chroot jail, is giving the following error: /bin/vsftpd: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory. Which TWO of the following are possible solutions? A. Get thevsftp source code and compile it statically. B. The file /etc/ld.so.conf must contain the path to the appropriate lib directory in the chroot jail C. Create a symbolic link that points to the required library outside thechroot jail D. Copy the required library to the appropriate lib directory in thechroot jail. E. Run the program using the commandchroot and the option --static_libs Answer: A,D QUESTION NO: 106 Which of the following can the program tripwire NOT check? "Pass Any Exam. Any Time."

36 A. File size. B. File signature. C. Permissions. D. File existence. E. Boot sectors. LPI : Practice Exam Answer: E QUESTION NO: 107 The following is an excerpt from the output of tcpdump -nli eth1 'udp': 13:03: IP > : A? lpi.org. (25) 13:03: IP > : /0/0 A (41) Which network service or protocol was used? A. FTP B. HTTP C. SSH D. DNS E. DHCP Answer: D QUESTION NO: 108 CORRECT TEXT According to the tcpdump output below, what is the IP address of the client host? Answer: QUESTION NO: 109 CORRECT TEXT Running tcpdump -nli eth1 'icmp' shows the following output: 11:56: IP > : icmp 64: echo request seq 1 11:56: IP > : icmp 64: echo reply seq 1 What command was used on the host , to generate this output? "Pass Any Exam. Any Time."

37 Answer: ping LPI : Practice Exam QUESTION NO: 110 A server is being used as a smurf amplifier, whereby it is responding to ICMP Echo-Request packets sent to its broadcast address. To disable this, which command needs to be run? A. ifconfig eth0 nobroadcast B. echo "0" > /proc/sys/net/ipv4/icmp_echo_accept_broadcasts C. iptables -A INPUT -p icmp -j REJECT D. echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts E. echo "1" > /proc/sys/net/ipv4/icmp_echo_nosmurf Answer: D QUESTION NO: 111 When the default policy for the iptables INPUT chain is set to DROP, why should a rule allowing traffic to localhost exist? A. All traffic tolocalhost must always be allowed. B. It doesn't matter;iptables never affects packets addressed to localhost C. Sendmail delivers s to localhost D. Some applications use thelocalhost interface to communicate with other applications. E. syslogd receives messages on localhost Answer: D QUESTION NO: 112 To be able to access the server with the IP address using HTTPS, a rule for iptables has to be written. Given that the client host's IP address is , which of the following commands is correct? A. iptables - A FORWARD -p tcp -s 0/0 -d dport 80 -j ACCEPT B. iptables - A FORWARD -p tcp -s d :443 -j ACCEPT. C. iptables - A FORWARD -p tcp -s d dport 443 -j ACCEPT. D. iptables - A INPUT -p tcp -s d :80 -j ACCEPT. E. iptables - A FORWARD -p tcp -s 0/0 -d dport 443 -j ACCEPT. Answer: C "Pass Any Exam. Any Time."

38 QUESTION NO: 113 CORRECT TEXT Which Apache directive is used to configure the main directory for the site, out of which it will serve documents? Answer: DocumentRoot QUESTION NO: 114 CORRECT TEXT Which file on a Postfix server modifies the sender address for outgoing s? Please enter only the file name without the path Answer: sender_canonical QUESTION NO: 115 When connecting to an SSH server for the first time, its fingerprint is received and stored in a file, which is located at: A. ~/.ssh/fingerprints B. ~/.ssh/id_dsa C. ~/.ssh/known_hosts D. ~/.ssh/id_dsa.pub E. ~/.ssh/gpg.txt Answer: C QUESTION NO: 116 CORRECT TEXT Which command can be used to save the current iptables rules into a file? Please enter only the command without path or parameters. Answer: iptables-save QUESTION NO: 117 Which THREE of the following actions should be considered when a FTP chroot jail is created? "Pass Any Exam. Any Time."

39 A. Create /dev/ and /etc/ in thechroot enviroment B. Create /etc/passwd in the chroot enviroment C. Create /var/cache/ftp in the chroot enviroment D. Create the user ftp in thechroot enviroment E. Create /usr/sbin/ in the chroot enviroment Answer: A,B,D QUESTION NO: 118 CORRECT TEXT All machines outside the network are able to send s through the server to addresses not served by that server. If the server accepts and delivers the , then it is a(n). Please enter the English term, without any punctuation. Answer: open relay QUESTION NO: 119 Connecting to a remote host on the same LAN using ssh public-key authentication works but forwarding X11 doesn't. The remote host allows access to both services. Which of the following can be the reason for that behaviour? A. The remote user'sssh_config file disallows X11 forwarding B. The remote server'ssshd_config file disallows X11 forwarding C. A different public key has to be used for X11 D. X11 cannot be forwarded if public-key authentication was used E. X11 though SSH needs a special X11 server application installed QUESTION NO: 120 An iptables firewall was configured to use the target MASQUERADE to share a dedicated wireless connection to the Internet with a few hosts on the local network. The Internet connection becomes very unstable in rainy days and users complain their connections drop when downloading or large files, while web browsing seems to be working fine. Which change to your iptables rules could alleviate the problem? A. Change the target MASQUERADE to SNAT B. Change the target MASQUERADE to DNAT C. Change the target MASQUERADE to BALANCE and provide a backup Internet connection "Pass Any Exam. Any Time."

40 D. Change the target MASQUERADE to REDIRECT and provide a backup Internet connection E. Change the target MASQUERADE to BNAT Answer: A QUESTION NO: 121 Which command line create an SSH tunnel for POP and SMTP protocols? A. ssh- L :110 -L :25-1 user -N mailhost B. ssh -L 25:110-1 user -N mailhost C. ssh -L mailhost:110 -L mailhost:25-1 user -N mailhost D. ssh -L mailhost:25:110-1 user E. ssh -L 110:mailhost:110 -L 25:mailhost:25-1 user -N mailhost Answer: E QUESTION NO: 122 CORRECT TEXT Please enter the command used to remove Kerberos tickets from the cache below. Answer: kdestory QUESTION NO: 123 CORRECT TEXT Please enter the Kerberos 5 configuration file name without path below. Answer: kdc.conf QUESTION NO: 124 Which of these tools can provide the most information about DNS queries? A. dig B. nslookup C. host D. named-checkconf E. named-checkzone Answer: A "Pass Any Exam. Any Time."

41 QUESTION NO: 125 Which records must be entered in a zone file in order to use "Round Robin Load Distribution" for a web server? A IN A IN A IN A B IN A ; ; C IN A D IN RR :3 E IN RR ; ; Answer: A QUESTION NO: 126 Which command would release the current IP address leased by a DHCP server? A. ipconfig /release B. ifconfig --release-all C. dhclient -r D. ifconfig --release E. pump --release Answer: C QUESTION NO: 127 Remote access to a CD-RW device on a machine on a LAN must be restricted to a selected user group. Select the TWO correct alternatives that describe the possible solutions for this problem. A. The remote access to these devices can be allowed to users by changing the display manager configuration and allowingsudo access for the user that will log in remotely B. Thepam_console module allows access configuration to these devices via console, including simultaneous access by many users C. Thepam_console module can be used to control access to devices via console, allowing/denying access to these devices in the user's session D. If thepam_console module is used, it must be checked as required, because it is essential for user authentication "Pass Any Exam. Any Time."

42 E. Through thesudo configuration file, it is possible to set users that will have the power of the root user, so they can access the devices. Besides that, it is important to configure the /etc/pam.d/su file, so the PAM modules can secure the service Answer: C,E QUESTION NO: 128 Select the alternative that shows the correct way to disable a user login (except for root) A. The use of thepam_nologin module along with the /etc/login configuration file B. The use of thepam_deny module along with the /etc/deny configuration file C. The use of thepam_pwdb module along with the /etc/pwdb.conf configuration file D. The use of thepam_console module along with the /etc/security/console.perms configuration file E. The use of thepam_nologin module along with the /etc/nologin configuration file Answer: E QUESTION NO: 129 A new user was created on a master NIS server using useradd but cannot log in from an NIS client. Older users can log in. Which step was probably forgotten, when creating the new user? A. Runningyppush on the NIS server to propagate map changes to NIS clients B. Running make inside /var/yp on the NIS server to generate new maps C. Starting theyppasswdd daemon on the NIS server to receive login re quests from NIS clients D. Starting theypxfr daemon on the NIS client to fetch map changes from the NIS server E. Restartingypxfr daemons on the NIS client and server to fetch map changes Answer: A QUESTION NO: 130 How can a user's default shell be checked, by querying an NIS server? A. ypquery user@example.com B. ypgrep user example.com C. ypmatch -d example.com user passwd D. ypcat -d example.com user E. user +shell "Pass Any Exam. Any Time."

43 Answer: D LPI : Practice Exam QUESTION NO: 131 A network has many network printers connected and they should get their addresses using DHCP. What information from each printer is needed to always assign them the same IP address when dhcpd is used as the DHCP server? A. MAC address B. Host name C. Serial number D. Factory default IP address E. Built-in network card type Answer: A QUESTION NO: 132 Which daemon is required on the client if an ethernet device gets its IP address from a central server? A. dhcp B. dhcpcd C. bootpd D. ethd E. dhcpd QUESTION NO: 133 Which TWO of the following wireless tools can be used to check the wireless network link quality? A. iwconfig B. iwlink C. iwscan D. iwifi E. iwspy Answer: A,E "Pass Any Exam. Any Time."

44 QUESTION NO: 134 LPI : Practice Exam Given this excerpt from an Apache configuration file, which of the numbered lines has INCORRECT syntax? 1: <VirtualHost *:80> 2: ServerAdmin 3: DocumentRoot /home/http/admin 4: ServerName admin.server.example.org 5: DirectoryIndex index.php default.php 6: ErrorLog logs/admin.server.example.org-error_log 7: CustomLog logs/admin.server.example.org-access_log common 8: </VirtualHost> A. 1 B. 1 and 4 C. 1, 4 and 7 D. 1 and 5 E. None. The configuration is valid Answer: E QUESTION NO: 135 CORRECT TEXT Please enter the complete command to create a new password file for HTTP basic authentication (/home/http/data/web _passwd) for user john. Answer: htpasswd -c /home/http/data/web_passwd john QUESTION NO: 136 Select the TWO correct statements about the following excerpt from httpd.conf: <Directory /var/web/dir1> <Files private.html> Order allow, deny Deny from all </Files> </Directory> A. The configuration will deny access to /var/web/dir1/private.html, /var/web/dirl/subdir2/private.html, /var/web/dirl/subdir3/private.html and any other instance of private.html found under the /var/web/dir1/directory. "Pass Any Exam. Any Time."

45 B. The configuration will deny access to /var/web/dir1/private.html, but it will allow access to /var/web/dirl/subdir2/private.htm1, for example. C. The configuration will allow access to any file named private.html under /var/web/dir1, but it will deny access to any other files D. The configuration will allow access just to the file named private.html under /var/web/dir1 E. The configuration will allow access to /var/web/private.html, if it exists Answer: A,E QUESTION NO: 137 Considering the following excerpt from the httpd.conf file, select the correct answer below: <Location> AllowOverride AuthConfig Indexes </Location> A. The Indexes directive in the excerpt allows the use of other index-related directives such as DirectoryIndex B. Both directivesauthconfig and Indexes found in the server's.htaccess file will be overridden by the same directives found in the httpd.conf file C. The AuthConfig used in the excerpt allows the use of other authentication-related directives such as AuthType D. The excerpt is incorrect, as theallowoverride cannot be used with Indexes, since the latter cannot be overridden E. The excerpt is incorrect, becauseallowoverride cannot be used inside a Location section Answer: E QUESTION NO: 138 Which of the following lines in the Apache configuration file would allow only clients with a valid certificate to access the website? A. SSLCA conf/ca.crt B. AuthType ssl C. IfModule libexec/ssl.c D. SSLRequire E. SSLVerifyClient require Answer: E "Pass Any Exam. Any Time."